U:\UUfasbgyzO\xugrzvmcBam\brynyeqlbck\qjsuttezwx.pdb
Static task
static1
Behavioral task
behavioral1
Sample
048eaa9e9334a08609cbab18355c7a9d_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
048eaa9e9334a08609cbab18355c7a9d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
048eaa9e9334a08609cbab18355c7a9d_JaffaCakes118
-
Size
135KB
-
MD5
048eaa9e9334a08609cbab18355c7a9d
-
SHA1
7040631369ca5fbfac6939aee54dd25ba6b5a465
-
SHA256
22368f335c16c4c54541097a4c8d8ac4963434f8ad2b78df87a2ab6a06175fa6
-
SHA512
9342c6d56cd5ec492ba299666ab69f2ce93c56655228554b875f10d6debe52a444e627eb9694f0be24cf85758452058dcc32c944dbc5459d34894868b5bb689e
-
SSDEEP
3072:ppBDY/9hGz5zWWuUYWA7uKY6x06v/AHT/T6JciDmtUSsiJI6:6XGtW9UYWA7u76xRAHzjiDJuJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 048eaa9e9334a08609cbab18355c7a9d_JaffaCakes118
Files
-
048eaa9e9334a08609cbab18355c7a9d_JaffaCakes118.dll windows:5 windows x86 arch:x86
15fb310d5882b32ab54c7a6fcbfb3862
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
PoUnregisterSystemState
RtlDeleteRegistryValue
RtlHashUnicodeString
RtlInitString
IoStartPacket
RtlEqualString
FsRtlFastCheckLockForRead
CcPreparePinWrite
PoRequestPowerIrp
RtlEqualUnicodeString
SeCaptureSubjectContext
ZwFsControlFile
RtlInitUnicodeString
RtlxUnicodeStringToAnsiSize
IoIsSystemThread
IoReleaseCancelSpinLock
RtlInitializeUnicodePrefix
PsLookupThreadByThreadId
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.code Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.icode Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fdata Size: 512B - Virtual size: 430B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ